Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”), this notice explains how your personal data are processed when you visit the smashhouse.com.tr website and use the forms on it.
1. Data controller
Yaska Turizm Ticaret Anonim Şirketi (“Smash House”)
Correspondence address: Halaskargazi Mah. Kuyumcu İrfan Sk. No:8, 34371 Şişli/İstanbul
Email: info@smashhouse.com.tr · Phone: 0850 255 15 31
2. What data do we process, for what purposes and on what legal grounds?
a) Contact form
- Data: first name, last name, email address, phone number, address (optional), your message.
- Purpose: to respond to your question or request and, where necessary, to contact you.
- Legal ground: the processing being necessary for us to respond to your request, and our legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)).
b) Franchise application form
- Data: first name, last name, email address, phone number, address, country, your reasons for applying, your source of financing, the number of stores you plan to open.
- Purpose: to evaluate your franchise application and to hold discussions with you.
- Legal ground: the processing being directly related to the establishment of a contract (KVKK Art. 5(2)(c)), and our legitimate interest (KVKK Art. 5(2)(f)).
c) Website security and operation
- Data: IP address, browser and device information, time of visit, requested page (server and security logs); strictly necessary cookies.
- Purpose: to operate the website, to protect it against attacks and misuse, and to fulfil our legal obligations.
- Legal ground: the processing being expressly provided for by law (Law No. 5651) and our legal obligation (KVKK Art. 5(2)(a) and (ç)), and our legitimate interest (KVKK Art. 5(2)(f)).
d) Visit statistics (cookieless)
- Data: page visited, page load time, browser type and approximate country. Cloudflare Web Analytics does not use cookies and does not identify you.
- Purpose: to measure the speed of the website and which pages are used.
- Legal ground: our legitimate interest (KVKK Art. 5(2)(f)).
e) Analytics and marketing cookies — only with your explicit consent
- Data: cookie identifiers, the pages you visit and your clicks (e.g. phone, directions, menu), where you came to our website from (campaign/UTM information), IP address. If you have allowed marketing cookies and you submit the contact form, your email address, phone number, first name and last name are hashed in your browser with SHA-256 (a one-way, non-reversible transformation) and used for matching for ad measurement.
- Purpose: to measure website use (Google Analytics), to measure the results of our ads, and to show ads again to people who have visited our website (Google Ads, Meta, TikTok).
- Legal ground: your explicit consent (KVKK Art. 5(1)). If you choose “Reject” in the cookie banner, these tags are not loaded at all. Exception: on the menu page opened by the QR codes in our branches (/qrmenu), these tags run without asking unless you have already made a choice. You may withdraw your consent at any time via the “Cookie Settings” link at the bottom of the website. Details: Cookie Policy.
3. How do we collect data?
We collect data electronically, through the information you enter in the forms, the information your browser transmits automatically when connecting to the website, and cookies.
4. To whom do we transfer data?
- Hostinger (email service): form messages are forwarded as emails to our business mailbox (info@smashhouse.com.tr) and stored there.
- Cloudflare, Inc.: the website’s traffic passes through Cloudflare for security and speed; cookieless visit statistics are kept with Cloudflare Web Analytics.
- Our hosting provider: the server on which the website runs, and server logs.
- Google LLC / Google Ireland Ltd., Meta Platforms Ireland Ltd. and TikTok: only if you have given explicit consent to analytics or marketing cookies, and only for the relevant category.
- Authorised public institutions and organisations: where legally required, and to the extent requested.
5. Transfers abroad
Some of the servers of Cloudflare, Hostinger, Google, Meta and TikTok are located outside Türkiye; the transfers above may therefore qualify as transfers abroad. Transfers are carried out in accordance with the conditions and safeguards set out in KVKK Art. 9. Transfers within the scope of analytics and marketing cookies take place only with your explicit consent and until you withdraw it.
6. Retention periods
- Contact form messages: up to 2 years after your request has been concluded.
- Franchise applications: if no contract is concluded, up to 2 years after the evaluation is completed; if a contract is concluded, for the term of the contract and the relevant statutory limitation period.
- Server and security logs: for the period required by the legislation (at least 1 and at most 2 years under Law No. 5651).
- Cookies: the period stated for each cookie in the Cookie Policy.
When the period expires, the data are deleted, destroyed or anonymised.
7. Your rights under KVKK Article 11
By applying to us, you have the right to:
- learn whether your personal data are processed;
- request information about the processing, if your data have been processed;
- learn the purpose of the processing and whether the data are used in accordance with that purpose;
- know the third parties in Türkiye or abroad to whom the data have been transferred;
- request rectification if the data have been processed incompletely or inaccurately;
- request erasure or destruction of the data under the conditions set out in KVKK Art. 7;
- request that rectification, erasure or destruction be notified to the third parties to whom the data have been transferred;
- object to a result against you arising from the analysis of the data exclusively by automated systems;
- claim compensation for damage if you suffer damage as a result of unlawful processing.
8. How can you apply?
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application, stating your first name, last name, signature (for written applications), Turkish ID number (for foreign nationals: nationality and passport number), address for notifications, email address (if any) and your request:
- in writing to Halaskargazi Mah. Kuyumcu İrfan Sk. No:8, 34371 Şişli/İstanbul, or
- from the email address you have previously notified to us and that is registered in our system, to info@smashhouse.com.tr.
Your application will be concluded within 30 days at the latest and, as a rule, free of charge. If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under KVKK Art. 14.